https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131900#M35975 <P>Convert your epoch time from millis to seconds</P> <P>... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y")</P> Sun, 31 May 2015 10:21:22 GMT Damien_Dallimor 2015-05-31T10:21:22Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131897#M35972 <P>Hi everyone,</P> <P>I have the following event:</P> <P>"... src=218.2.3.256 act=block app=ips <STRONG>rt=1433065461040</STRONG> ...."<BR /> The <STRONG>rt</STRONG> field is a epoch computer time format.</P> <P>Is it possible to convert the "rt" field to a user-friendly format? I searched through some of the other questions but none really addressed this specific question.</P> <P>Thanks.</P> Sun, 31 May 2015 09:53:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131897#M35972 bugnet 2015-05-31T09:53:06Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131898#M35973 <P>You can use the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/CommonEvalFunctions">eval function</A> strftime </P> <PRE><CODE>... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y") </CODE></PRE> Sun, 31 May 2015 10:11:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131898#M35973 Damien_Dallimor 2015-05-31T10:11:42Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131899#M35974 <P>Does not work for me .<BR /> The "formatted_time" always displayed with the same value : 23:59:59 31-12-9999</P> Sun, 31 May 2015 10:17:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131899#M35974 bugnet 2015-05-31T10:17:14Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131900#M35975 <P>Convert your epoch time from millis to seconds</P> <P>... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y")</P> Sun, 31 May 2015 10:21:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131900#M35975 Damien_Dallimor 2015-05-31T10:21:22Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131901#M35976 <P>Looks good. How I can do it for all variations of the "rt" numbers?</P> Sun, 31 May 2015 10:31:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131901#M35976 bugnet 2015-05-31T10:31:40Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131902#M35977 <P>Can you give more examples ?</P> Sun, 31 May 2015 10:36:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131902#M35977 Damien_Dallimor 2015-05-31T10:36:32Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131903#M35978 <P>Its working! <BR /> Is it possible to do it permanent ?<BR /> I mean- To calculation it automatically on the "rt" field ?</P> Sun, 31 May 2015 10:43:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131903#M35978 bugnet 2015-05-31T10:43:39Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131904#M35979 <P>Not sure what you mean but thats what splunk is for ,to transform the fields as you want when creating the reports of the dashboards</P> Thu, 03 Mar 2016 08:32:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131904#M35979 chamambom 2016-03-03T08:32:55Z https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131905#M35980 <P>you need to do a field transform at search or index time - <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Managefieldtransforms">http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Managefieldtransforms</A></P> Thu, 03 Mar 2016 08:48:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Convert-epoch-time-to-human-readable-format/m-p/131905#M35980 anthonysomerset 2016-03-03T08:48:20Z